spec-lock
Pass
Audited by Gen Agent Trust Hub on Mar 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it reads and processes the content of code and documentation files to detect semantic drift. Malicious instructions embedded in these files by an external actor could be interpreted and executed by the agent during the analysis or patch generation phases. • Ingestion points: Reads local code and documentation files (e.g., SPEC.md, CLAUDE.md) via the Read tool. • Capability inventory: Bash, Write, Edit, and Read tools. • Boundary markers: No markers or specific instructions are provided to the agent to ignore embedded commands. • Sanitization: No content validation is described before the data is processed by the agent.
- [COMMAND_EXECUTION]: The skill instructs the agent to execute a Python script at a hardcoded absolute path (/a0/usr/plugins/spec-lock/spec-lock.py). The source code for this script is not included in the skill, making its behavior unverifiable and potentially dangerous if the environment is compromised.
- [COMMAND_EXECUTION]: The skill encourages the use of PostToolUse hooks to trigger the external script automatically after every Edit or Write tool usage. This creates an automated execution loop that monitors all file changes and executes code without direct user intervention for each run.
Audit Metadata